① Journal · Audit defense
A vendor audit is a documentation contest. It is won or lost on whether your records can prove the entitlement behind every product and every capacity number, before the auditor asks. Here are the records to keep current, and the reconciliation cycle that keeps them true.
Audits are not won on goodwill. They are won on records.
When an audit notice lands, the outcome is already mostly decided by work done long before. An audit is a documentation contest: the vendor measures what is deployed and compares it to what you can prove you are entitled to run. If your records cleanly tie an entitlement to every product and every capacity figure, the audit confirms compliance and closes quietly. If they do not, the burden lands on you to disprove the vendor's number against a deadline, with the vendor controlling the clock. That is the position that produces a settlement, and it is a position you choose months earlier by how you keep your records.
The frustrating part is that mainframe shops usually are compliant. The gap is rarely real overuse; it is the inability to prove entitlement quickly when challenged. Years of amendments, acquired contracts, renamed products, and undocumented retirements turn a compliant estate into one that cannot answer for itself under pressure. License records hygiene is the discipline that closes that gap before it is exploited. Read this with our building your mainframe software inventory guide and our audit defense service.
The records an audit tests · keep each current and reconciled, not reconstructed under a clock
| Record | What it must show | The audit question it answers |
|---|---|---|
| Agreements and amendments | Every master agreement and signed change, in one current set | What did we actually agree, and when |
| Entitlement register | Quantity and metric entitled for each product | What are we licensed to run |
| Capacity terms | Contracted capacity and any sub-capacity provisions | At what capacity are we entitled to run it |
| Consumption history | SCRT and R4HA history, validated independently | What did we actually consume, and can we prove it |
| Deployment inventory | What is installed, mapped product by product to entitlement | Does deployed match entitled |
| Retirement evidence | Proof that decommissioned products were actually removed | Can we show we stopped using what we dropped |
| Audit and change log | History of prior audits, findings, and contract changes | What has already been settled and agreed |
Exact scope varies by publisher and contract; the principle is constant. Every figure a vendor can measure should have a record behind it that you maintain, so the audit reconciles to something already true rather than something you assemble under deadline.
Reconcile deployment against entitlement on a regular cycle, commonly quarterly, plus whenever a contract, product set, or machine changes. Records reconciled on a calendar are already true when the audit arrives. Records reconciled under audit pressure are slow, contested, and expensive.
Reconcile before you are asked, not after.
Do not let the only version of your SCRT and R4HA history be the one the vendor holds. Keep and validate your own consumption record so you can confirm or challenge the vendor's figure from your own data. An undisputed number is whichever side can evidence it first.
Own your consumption data, do not borrow it.
Decommissioned products are a frequent audit trap: the contract dropped them but the evidence that they stopped running was never kept. Document removals when they happen, with dates and confirmation, so a retired product cannot be counted back as deployed years later.
A retirement without evidence is still a liability.
Acquired estates and renamed products break the record chain, which is where gaps hide. When a publisher renames a product or you absorb another shop, carry the entitlement history forward intact so the lineage from original agreement to current deployment is never lost.
A broken paper trail is the audit's opening.
④ The advantage records buy
A clean record turns an audit into a confirmation. A missing one turns it into a settlement. The hygiene is cheap. The gap is not.
Mobilization on an audit notice
Mainframe spend negotiated on the buyer side
Engagements delivered since 2019
An audit compares what is deployed to what you can prove you are entitled to run. Clean records that tie an entitlement to every product and capacity figure close the audit as a confirmation. Missing records hand you the burden of disproving the vendor's number under a clock.
Agreements and amendments, the entitlement register, capacity terms, validated consumption history, the deployment inventory mapped to entitlement, retirement evidence, and the audit and change log. Together they answer the audit's questions before they are asked.
On a regular cycle, commonly quarterly, plus whenever a contract, product set, or the hardware changes. Reconciling under audit pressure is slow and contested; reconciling on a calendar means the audit finds a record that is already true.
Compliance you cannot prove quickly is not protection. Most shops are compliant; the loss comes from being unable to evidence entitlement under pressure. The records turn being right into proving it. See our audit defense service.
Related: building your mainframe software inventory · the SAM manager guide · audit rights clauses to negotiate · audit defense service
Audit notice or renewal under 18 months out? We mobilize within 48 hours.
Get expert help →